Bypass Multi-Factor Authentication for a Specific User in Auth0

Administrators can configure Auth0 to bypass the Multi-Factor Authentication (MFA) challenge for a specific user, enabling automated testing or scanning systems to access a site without interruption. Creating a Post-Login Action with a script that disables MFA for a designated email address fulfills this requirement.

• Auth0
• Multi-Factor Authentication (MFA)
• Post-Login Actions
• Bypass MFA

How is Multi-Factor Authentication bypassed for a specific Auth0 user?

NOTE: Bypassing MFA for any account reduces security. Administrators must tightly control and monitor the account used for testing. Activate this action only in non-production environments, such as staging or testing.

Bypass the MFA challenge for a specific user by navigating to the post-login triggers in the Auth0 Dashboard and adding a custom script to a new or existing action.

1. Go to Actions > Triggers in the Auth0 Dashboard.
2. Select post-login.
3. Add the following script to an existing or new action

   exports.onExecutePostLogin = async (event, api) => {
     const userEmail = event.user.email;
   
     // Specific user email to skip MFA
     const noMFA_UserEmail = "useruser@test.com";
   
     // Determine if MFA should be skipped
     const skipMFA = userEmail === noMFA_UserEmail;
   
     // Disable MFA if skipMFA is true
     if (skipMFA) {
       api.multifactor.enable("none");
     }
   };